Splunk Search

help on token which has to return empty values

jip31
Motivator

hello

 

I use a scheduled search where I stats events like this :

| stats last(LastReboot) as "Last reboot date" by host CATEGORY DEPARTMENT 

For the moment, in DEPARTMENT field I have a lot of empty fields

In the dashboard, I call my scheduled search and I use token filters

| loadjob savedsearch="admin:SA_XXX_sh:LogLogon" 
| search CATEGORY=$tok_filtercategory|s$ 
| search DEPARTMENT=$tok_filterdepartment$ 

What I dont understand is why the events are not displayed if DEPARTMENT fiel is empty?

Thanks

Tags (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @jip31,

stats command cannot group empty fields, you can try below;

| fillnull value="empty" DEPARTMENT
| stats last(LastReboot) as "Last reboot date" by host CATEGORY DEPARTMENT
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @jip31,

stats command cannot group empty fields, you can try below;

| fillnull value="empty" DEPARTMENT
| stats last(LastReboot) as "Last reboot date" by host CATEGORY DEPARTMENT
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...